/**
 * @file tests/unit/test_http_pairing.cpp
 * @brief Test src/nvhttp.cpp HTTP pairing process
 */

// test includes
#include "../tests_common.h"

// standard includes
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <format>
#include <future>
#include <mutex>
#include <sstream>
#include <thread>
#include <vector>

// lib includes
#include <Simple-Web-Server/client_http.hpp>
#include <Simple-Web-Server/server_http.hpp>

// local includes
#include <src/config.h>
#include <src/nvhttp.h>

using namespace nvhttp;

struct pairing_input {
  std::shared_ptr<pair_session_t> session;
  /**
   * Normally server challenge is generated by the server, but for testing purposes
   * we can override it with a custom value. This way the process is deterministic.
   */
  std::string override_server_challenge;
  std::string pin;
  std::string client_challenge;
  std::string server_challenge_resp;
  std::string client_pairing_secret;
};

struct pairing_output {
  bool phase_1_success;
  bool phase_2_success;
  bool phase_3_success;
  bool phase_4_success;
};

const std::string PRIVATE_KEY = R"(-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDLePNlWN06FLlM
ujWzIX8UICO7SWfH5DXlafVjpxwi/WCkdO6FxixqRNGu71wMvJXFbDlNR8fqX2xo
+eq17J3uFKn+qdjmP3L38bkqxhoJ/nCrXkeGyCTQ+Daug63ZYSJeW2Mmf+LAR5/i
/fWYfXpSlbcf5XJQPEWvENpLqWu+NOU50dJXIEVYpUXRx2+x4ZbwkH7tVJm94L+C
OUyiJKQPyWgU2aFsyJGwHFfePfSUpfYHqbHZV/ILpY59VJairBwE99bx/mBvMI7a
hBmJTSDuDffJcPDhFF5kZa0UkQPrPvhXcQaSRti7v0VonEQj8pTSnGYr9ktWKk92
wxDyn9S3AgMBAAECggEAbEhQ14WELg2rUz7hpxPTaiV0fo4hEcrMN+u8sKzVF3Xa
QYsNCNoe9urq3/r39LtDxU3D7PGfXYYszmz50Jk8ruAGW8WN7XKkv3i/fxjv8JOc
6EYDMKJAnYkKqLLhCQddX/Oof2udg5BacVWPpvhX6a1NSEc2H6cDupfwZEWkVhMi
bCC3JcNmjFa8N7ow1/5VQiYVTjpxfV7GY1GRe7vMvBucdQKH3tUG5PYXKXytXw/j
KDLaECiYVT89KbApkI0zhy7I5g3LRq0Rs5fmYLCjVebbuAL1W5CJHFJeFOgMKvnO
QSl7MfHkTnzTzUqwkwXjgNMGsTosV4UloL9gXVF6GQKBgQD5fI771WETkpaKjWBe
6XUVSS98IOAPbTGpb8CIhSjzCuztNAJ+0ey1zklQHonMFbdmcWTkTJoF3ECqAos9
vxB4ROg+TdqGDcRrXa7Twtmhv66QvYxttkaK3CqoLX8CCTnjgXBCijo6sCpo6H1T
+y55bBDpxZjNFT5BV3+YPBfWQwKBgQDQyNt+saTqJqxGYV7zWQtOqKORRHAjaJpy
m5035pky5wORsaxQY8HxbsTIQp9jBSw3SQHLHN/NAXDl2k7VAw/axMc+lj9eW+3z
2Hv5LVgj37jnJYEpYwehvtR0B4jZnXLyLwShoBdRPkGlC5fs9+oWjQZoDwMLZfTg
eZVOJm6SfQKBgQDfxYcB/kuKIKsCLvhHaSJpKzF6JoqRi6FFlkScrsMh66TCxSmP
0n58O0Cqqhlyge/z5LVXyBVGOF2Pn6SAh4UgOr4MVAwyvNp2aprKuTQ2zhSnIjx4
k0sGdZ+VJOmMS/YuRwUHya+cwDHp0s3Gq77tja5F38PD/s/OD8sUIqJGvQKBgBfI
6ghy4GC0ayfRa+m5GSqq14dzDntaLU4lIDIAGS/NVYDBhunZk3yXq99Mh6/WJQVf
Uc77yRsnsN7ekeB+as33YONmZm2vd1oyLV1jpwjfMcdTZHV8jKAGh1l4ikSQRUoF
xTdMb5uXxg6xVWtvisFq63HrU+N2iAESmMnAYxRZAoGAVEFJRRjPrSIUTCCKRiTE
br+cHqy6S5iYRxGl9riKySBKeU16fqUACIvUqmqlx4Secj3/Hn/VzYEzkxcSPwGi
qMgdS0R+tacca7NopUYaaluneKYdS++DNlT/m+KVHqLynQr54z1qBlThg9KGrpmM
LGZkXtQpx6sX7v3Kq56PkNk=
-----END PRIVATE KEY-----)";
const std::string PUBLIC_CERT = R"(-----BEGIN CERTIFICATE-----
MIIC6zCCAdOgAwIBAgIBATANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJJVDEW
MBQGA1UECgwNR2FtZXNPbldoYWxlczESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIy
MDQwOTA5MTYwNVoXDTQyMDQwNDA5MTYwNVowOTELMAkGA1UEBhMCSVQxFjAUBgNV
BAoMDUdhbWVzT25XaGFsZXMxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAMt482VY3ToUuUy6NbMhfxQgI7tJZ8fkNeVp
9WOnHCL9YKR07oXGLGpE0a7vXAy8lcVsOU1Hx+pfbGj56rXsne4Uqf6p2OY/cvfx
uSrGGgn+cKteR4bIJND4Nq6DrdlhIl5bYyZ/4sBHn+L99Zh9elKVtx/lclA8Ra8Q
2kupa7405TnR0lcgRVilRdHHb7HhlvCQfu1Umb3gv4I5TKIkpA/JaBTZoWzIkbAc
V9499JSl9gepsdlX8guljn1UlqKsHAT31vH+YG8wjtqEGYlNIO4N98lw8OEUXmRl
rRSRA+s++FdxBpJG2Lu/RWicRCPylNKcZiv2S1YqT3bDEPKf1LcCAwEAATANBgkq
hkiG9w0BAQsFAAOCAQEAqPBqzvDjl89pZMll3Ge8RS7HeDuzgocrhOcT2jnk4ag7
/TROZuISjDp6+SnL3gPEt7E2OcFAczTg3l/wbT5PFb6vM96saLm4EP0zmLfK1FnM
JDRahKutP9rx6RO5OHqsUB+b4jA4W0L9UnXUoLKbjig501AUix0p52FBxu+HJ90r
HlLs3Vo6nj4Z/PZXrzaz8dtQ/KJMpd/g/9xlo6BKAnRk5SI8KLhO4hW6zG0QA56j
X4wnh1bwdiidqpcgyuKossLOPxbS786WmsesaAWPnpoY6M8aija+ALwNNuWWmyMg
9SVDV76xJzM36Uq7Kg3QJYTlY04WmPIdJHkCtXWf9g==
-----END CERTIFICATE-----)";

struct PairingTest: BaseTest, testing::WithParamInterface<std::tuple<pairing_input, pairing_output>> {
  /**
   * @brief Isolate pairing authorization state and suppress persistence for the test.
   */
  void SetUp() override {
    BaseTest::SetUp();
    original_fresh_state = config::sunshine.flags[config::flag::FRESH_STATE];
    config::sunshine.flags[config::flag::FRESH_STATE] = true;
    nvhttp::test_support::reset_client_state();
  }

  /**
   * @brief Restore the caller's fresh-state configuration after the pairing test.
   */
  void TearDown() override {
    nvhttp::test_support::reset_client_state();
    config::sunshine.flags[config::flag::FRESH_STATE] = original_fresh_state;
    BaseTest::TearDown();
  }

private:
  bool original_fresh_state;  ///< Fresh-state flag restored after each pairing test.
};

TEST_P(PairingTest, Run) {
  auto [input, expected] = GetParam();

  boost::property_tree::ptree tree;

  setup(PRIVATE_KEY, PUBLIC_CERT);

  // phase 1
  getservercert(*input.session, tree, input.pin);
  ASSERT_EQ(tree.get<int>("root.paired") == 1, expected.phase_1_success);
  if (!expected.phase_1_success) {
    return;
  }

  // phase 2
  clientchallenge(*input.session, tree, input.client_challenge);
  ASSERT_EQ(tree.get<int>("root.paired") == 1, expected.phase_2_success);
  if (!expected.phase_2_success) {
    return;
  }

  // phase 3
  serverchallengeresp(*input.session, tree, input.server_challenge_resp);
  ASSERT_EQ(tree.get<int>("root.paired") == 1, expected.phase_3_success);
  if (!expected.phase_3_success) {
    return;
  }
  input.session->serverchallenge = input.override_server_challenge;

  // phase 4
  auto input_client_cert = input.session->client.cert;  // Will be moved
  clientpairingsecret(*input.session, tree, input.client_pairing_secret);
  ASSERT_EQ(tree.get<int>("root.paired") == 1, expected.phase_4_success);
  ASSERT_TRUE(input.session->completion->result.has_value());
  EXPECT_EQ(*input.session->completion->result, expected.phase_4_success);

  if (expected.phase_4_success) {
    ASSERT_TRUE(nvhttp::test_support::authorize_client_certificate(input_client_cert));
  }
}

INSTANTIATE_TEST_SUITE_P(
  TestWorkingPairing,
  PairingTest,
  testing::Values(
    std::make_tuple(
      pairing_input {
        .session = std::make_shared<pair_session_t>(
          pair_session_t {
            .client = {
              .uniqueID = "1234",
              .cert = PUBLIC_CERT,
              .name = "test"
            },
            .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}
          }
        ),
        .override_server_challenge = util::from_hex_vec("AAAAAAAAAAAAAAAA", true),
        .pin = "5338",
        /* AES("CLIENT CHALLENGE") */
        .client_challenge = util::from_hex_vec("741CD3D6890C16DA39D53BCA0893AAF0", true),
        /* SHA = SHA265(server_challenge + public cert signature + "SECRET  ") = "6493DAE49C913E1AEAF37C1072F71D664B72B2C4DA1FFB4720BECE0D929E008A"
         * AES( SHA ) */
        .server_challenge_resp = util::from_hex_vec("920BABAE9F7599AA1CA8EC87FB3454C91872A7D8D5127DDC176C2FDAE635CF7A", true),
        /* secret + x509 signature */
        .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFF"  // secret
                                                    "9BB74D8DE2FF006C3F47FC45EFDAA97D433783AFAB3ACD85CA7ED2330BB2A7BD18A5B044AF8CAC177116FAE8A6E8E44653A8944A0F8EA138B2E013756D847D2C4FC52F736E2E7E9B4154712B18F8307B2A161E010F0587744163E42ECA9EA548FC435756EDCF1FEB94037631ABB72B29DDAC0EA5E61F2DBFCC3B20AA021473CC85AC98D88052CA6618ED1701EFBF142C18D5E779A3155B84DF65057D4823EC194E6DF14006793E8D7A3DCCE20A911636C4E01ECA8B54B9DE9F256F15DE9A980EA024B30D77579140D45EC220C738164BDEEEBF7364AE94A5FF9B784B40F2E640CE8603017DEEAC7B2AD77B807C643B7B349C110FE15F94C7B3D37FF15FDFBE26",
                                                    true)
      },
      pairing_output {true, true, true, true}
    ),
    // Testing that when passing some empty values we aren't triggering any exception
    std::make_tuple(pairing_input {
                      .session = std::make_shared<pair_session_t>(pair_session_t {.client = {}, .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}}),
                      .override_server_challenge = {},
                      .pin = {},
                      .client_challenge = {},
                      .server_challenge_resp = {},
                      .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFFxDEADBEEF", true),
                    },
                    // Only phase 4 will fail, when we check what has been exchanged
                    pairing_output {true, true, true, false}),
    // Testing that when passing some empty values we aren't triggering any exception
    std::make_tuple(pairing_input {
                      .session = std::make_shared<pair_session_t>(pair_session_t {.client = {.cert = PUBLIC_CERT}, .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}}),
                      .override_server_challenge = {},
                      .pin = {},
                      .client_challenge = {},
                      .server_challenge_resp = {},
                      .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFFxDEADBEEF", true),
                    },
                    // Only phase 4 will fail, when we check what has been exchanged
                    pairing_output {true, true, true, false})
  )
);

INSTANTIATE_TEST_SUITE_P(
  TestFailingPairing,
  PairingTest,
  testing::Values(
    /**
     * Wrong PIN
     */
    std::make_tuple(
      pairing_input {
        .session = std::make_shared<pair_session_t>(
          pair_session_t {
            .client = {
              .uniqueID = "1234",
              .cert = PUBLIC_CERT,
              .name = "test"
            },
            .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}
          }
        ),
        .override_server_challenge = util::from_hex_vec("AAAAAAAAAAAAAAAA", true),
        .pin = "0000",
        .client_challenge = util::from_hex_vec("741CD3D6890C16DA39D53BCA0893AAF0", true),
        .server_challenge_resp = util::from_hex_vec("920BABAE9F7599AA1CA8EC87FB3454C91872A7D8D5127DDC176C2FDAE635CF7A", true),
        .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFF"  // secret
                                                    "9BB74D8DE2FF006C3F47FC45EFDAA97D433783AFAB3ACD85CA7ED2330BB2A7BD18A5B044AF8CAC177116FAE8A6E8E44653A8944A0F8EA138B2E013756D847D2C4FC52F736E2E7E9B4154712B18F8307B2A161E010F0587744163E42ECA9EA548FC435756EDCF1FEB94037631ABB72B29DDAC0EA5E61F2DBFCC3B20AA021473CC85AC98D88052CA6618ED1701EFBF142C18D5E779A3155B84DF65057D4823EC194E6DF14006793E8D7A3DCCE20A911636C4E01ECA8B54B9DE9F256F15DE9A980EA024B30D77579140D45EC220C738164BDEEEBF7364AE94A5FF9B784B40F2E640CE8603017DEEAC7B2AD77B807C643B7B349C110FE15F94C7B3D37FF15FDFBE26",
                                                    true)
      },
      pairing_output {true, true, true, false}
    ),
    /**
     * Wrong client challenge
     */
    std::make_tuple(pairing_input {.session = std::make_shared<pair_session_t>(pair_session_t {.client = {.uniqueID = "1234", .cert = PUBLIC_CERT, .name = "test"}, .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}}), .override_server_challenge = util::from_hex_vec("AAAAAAAAAAAAAAAA", true), .pin = "5338", .client_challenge = util::from_hex_vec("741CD3D6890C16DA39D53BCA0893AAF0", true), .server_challenge_resp = util::from_hex_vec("WRONG", true),
                                   .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFF"  // secret
                                                                               "9BB74D8DE2FF006C3F47FC45EFDAA97D433783AFAB3ACD85CA7ED2330BB2A7BD18A5B044AF8CAC177116FAE8A6E8E44653A8944A0F8EA138B2E013756D847D2C4FC52F736E2E7E9B4154712B18F8307B2A161E010F0587744163E42ECA9EA548FC435756EDCF1FEB94037631ABB72B29DDAC0EA5E61F2DBFCC3B20AA021473CC85AC98D88052CA6618ED1701EFBF142C18D5E779A3155B84DF65057D4823EC194E6DF14006793E8D7A3DCCE20A911636C4E01ECA8B54B9DE9F256F15DE9A980EA024B30D77579140D45EC220C738164BDEEEBF7364AE94A5FF9B784B40F2E640CE8603017DEEAC7B2AD77B807C643B7B349C110FE15F94C7B3D37FF15FDFBE26",
                                                                               true)},
                    pairing_output {true, true, true, false}),
    /**
     * Wrong signature
     */
    std::make_tuple(pairing_input {.session = std::make_shared<pair_session_t>(pair_session_t {.client = {.uniqueID = "1234", .cert = PUBLIC_CERT, .name = "test"}, .async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}}), .override_server_challenge = util::from_hex_vec("AAAAAAAAAAAAAAAA", true), .pin = "5338", .client_challenge = util::from_hex_vec("741CD3D6890C16DA39D53BCA0893AAF0", true), .server_challenge_resp = util::from_hex_vec("920BABAE9F7599AA1CA8EC87FB3454C91872A7D8D5127DDC176C2FDAE635CF7A", true),
                                   .client_pairing_secret = util::from_hex_vec("000102030405060708090A0B0C0D0EFF"  // secret
                                                                               "NOSIGNATURE",  // Wrong signature
                                                                               true)},
                    pairing_output {true, true, true, false}),
    /**
     * null values (phase 1)
     */
    std::make_tuple(pairing_input {.session = std::make_shared<pair_session_t>()}, pairing_output {.phase_1_success = false}),
    /**
     * null values (phase 4, phase 2 and 3 have no reason to fail since we are running them in order)
     */
    std::make_tuple(pairing_input {.session = std::make_shared<pair_session_t>(pair_session_t {.async_insert_pin = {.salt = "ff5dc6eda99339a8a0793e216c4257c4"}})}, pairing_output {true, true, true, false})
  )
);

TEST(PairingTest, OutOfOrderCalls) {
  boost::property_tree::ptree tree;

  setup(PRIVATE_KEY, PUBLIC_CERT);

  pair_session_t sess {};

  clientchallenge(sess, tree, "test");
  ASSERT_FALSE(tree.get<int>("root.paired") == 1);

  serverchallengeresp(sess, tree, "test");
  ASSERT_FALSE(tree.get<int>("root.paired") == 1);

  clientpairingsecret(sess, tree, "test");
  ASSERT_FALSE(tree.get<int>("root.paired") == 1);

  // This should work, it's the first time we call it
  sess.async_insert_pin.salt = "ff5dc6eda99339a8a0793e216c4257c4";
  getservercert(sess, tree, "test");
  ASSERT_TRUE(tree.get<int>("root.paired") == 1);

  // Calling it again should fail
  getservercert(sess, tree, "test");
  ASSERT_FALSE(tree.get<int>("root.paired") == 1);
}

namespace {
  /**
   * @brief Stream buffer that holds console input until a pairing test releases it.
   */
  class gated_input_buffer: public std::streambuf {
  public:
    /**
     * @brief Make the buffered input available to its reader.
     */
    void release() {
      {
        std::lock_guard lock {mutex_};
        released_ = true;
      }
      condition_.notify_all();
    }

  protected:
    /**
     * @brief Wait for release and expose the buffered PIN to the input stream.
     *
     * @return The first buffered character, or end-of-file after it is consumed.
     */
    int_type underflow() override {
      std::unique_lock lock {mutex_};
      condition_.wait(lock, [this]() {
        return released_;
      });
      if (gptr() == nullptr) {
        setg(input_.data(), input_.data(), input_.data() + input_.size());
      }
      return gptr() == egptr() ? traits_type::eof() : traits_type::to_int_type(*gptr());
    }

  private:
    std::string input_ = "1234\n";  ///< PIN text released to the pairing handler.
    std::mutex mutex_;  ///< Protects the release flag.
    std::condition_variable condition_;  ///< Wakes the blocked input reader.
    bool released_ = false;  ///< Whether the reader may consume the PIN.
  };

  /**
   * @brief Restore the process input stream after a console-PIN test.
   */
  class cin_buffer_guard {
  public:
    /**
     * @brief Redirect standard input to a test buffer.
     *
     * @param replacement Stream buffer to read during the test.
     */
    explicit cin_buffer_guard(std::streambuf *replacement):
        original_(std::cin.rdbuf(replacement)) {
      std::cin.clear();
    }

    /**
     * @brief Restore the original standard-input buffer and stream state.
     */
    ~cin_buffer_guard() noexcept {
      try {
        std::cin.rdbuf(original_);
        std::cin.clear();
      } catch (const std::ios_base::failure &stream_error) {
        ADD_FAILURE() << "Failed to restore the standard-input buffer: " << stream_error.what();
      }
    }

    cin_buffer_guard(const cin_buffer_guard &) = delete;
    cin_buffer_guard &operator=(const cin_buffer_guard &) = delete;

  private:
    std::streambuf *original_;  ///< Process input buffer restored at scope exit.
  };

  /**
   * @brief Build a pairing session that is awaiting operator approval.
   *
   * @param unique_id Client-controlled GameStream unique identifier.
   * @param device_name Client-reported device name.
   * @param address Network address associated with the request.
   * @return Pairing session ready for insertion into pending storage.
   */
  pair_session_t pending_session(std::string unique_id, std::string device_name, std::string address) {
    return {
      .client = {
        .uniqueID = std::move(unique_id),
      },
      .async_insert_pin = {
        .salt = "ff5dc6eda99339a8a0793e216c4257c4",
        .device_name = std::move(device_name),
        .address = std::move(address),
      },
    };
  }

  /**
   * @brief Fixture that isolates tests using global pending-pairing storage.
   */
  class PairingSessionRegistryTest: public BaseTest {
  protected:
    void SetUp() override {
      expire_pair_sessions(std::chrono::steady_clock::time_point::max());
    }

    void TearDown() override {
      expire_pair_sessions(std::chrono::steady_clock::time_point::max());
    }
  };

  /**
   * @brief Exercise the production pairing dispatcher through a local HTTP server.
   */
  class PairingHttpHandlerTest: public BaseTest {
  protected:
    /**
     * @brief Start an isolated plain-HTTP pairing endpoint.
     */
    void SetUp() override {
      BaseTest::SetUp();
      expire_pair_sessions(std::chrono::steady_clock::time_point::max());
      original_pin_stdin_ = config::sunshine.flags[config::flag::PIN_STDIN];
      original_ping_timeout_ = config::stream.ping_timeout;
      config::sunshine.flags[config::flag::PIN_STDIN] = false;

      server_ = std::make_unique<SimpleWeb::Server<SimpleWeb::HTTP>>();
      server_->config.port = 0;
      server_->config.reuse_address = true;
      server_->config.timeout_request = 5;
      server_->config.timeout_content = 5;
      server_->resource["^/pair$"]["GET"] = nvhttp::test_support::pair_http;
      server_thread_ = std::jthread([this]() {
        server_->start([this](const unsigned short assigned_port) {
          port_ = assigned_port;
        });
      });

      for (int attempt = 0; attempt < 100 && port_ == 0; ++attempt) {
        std::this_thread::sleep_for(std::chrono::milliseconds {10});
      }
      ASSERT_NE(port_, 0) << "Pairing test server failed to start";

      client_ = std::make_unique<SimpleWeb::Client<SimpleWeb::HTTP>>(std::format("localhost:{}", port_.load()));
      client_->config.timeout = 5;
    }

    /**
     * @brief Stop the endpoint and restore pairing configuration.
     */
    void TearDown() override {
      expire_pair_sessions(std::chrono::steady_clock::time_point::max());
      if (server_) {
        server_->stop();
      }
      if (server_thread_.joinable()) {
        server_thread_.join();
      }
      client_.reset();
      server_.reset();
      config::sunshine.flags[config::flag::PIN_STDIN] = original_pin_stdin_;
      config::stream.ping_timeout = original_ping_timeout_;
      BaseTest::TearDown();
    }

    /**
     * @brief Build the query for the initial certificate phase.
     *
     * @param unique_id Client pairing identifier.
     * @param salt Hexadecimal PIN salt.
     * @return Request target for the local pairing endpoint.
     */
    static std::string server_certificate_target(const std::string_view unique_id, const std::string_view salt = "ff5dc6eda99339a8a0793e216c4257c4") {
      return std::format(
        "/pair?uniqueid={}&phrase=getservercert&clientcert={}&salt={}&devicename=TestClient",
        unique_id,
        util::hex_vec(PUBLIC_CERT, true),
        salt
      );
    }

    /**
     * @brief Read the response body from the local pairing endpoint.
     *
     * @param target Request target including query parameters.
     * @return XML response body.
     */
    std::string request(const std::string_view target) {
      return client_->request("GET", std::string {target})->content.string();
    }

    /**
     * @brief Wait for a request to enter the pending pairing registry.
     *
     * @return The operator-facing pairing identifier, or an empty string on timeout.
     */
    static std::string wait_for_pending_pairing() {
      for (int attempt = 0; attempt < 100; ++attempt) {
        if (const auto pending = get_pending_pairings(); !pending.empty()) {
          return pending.front().id;
        }
        std::this_thread::sleep_for(std::chrono::milliseconds {10});
      }
      return {};
    }

  private:
    std::unique_ptr<SimpleWeb::Server<SimpleWeb::HTTP>> server_;  ///< Local pairing HTTP server.
    std::unique_ptr<SimpleWeb::Client<SimpleWeb::HTTP>> client_;  ///< Client connected to the local server.
    std::jthread server_thread_;  ///< Thread running the local server event loop.
    std::atomic<unsigned short> port_ {0};  ///< Ephemeral port assigned to the local server.
    bool original_pin_stdin_;  ///< Console-PIN flag restored after each test.
    std::chrono::milliseconds original_ping_timeout_;  ///< Configured client timeout restored after each test.
  };
}  // namespace

TEST_F(PairingHttpHandlerTest, ImmediateRequestsReturnExpectedStatus) {
  EXPECT_NE(request("/pair"sv).find("status_code=\"400\""), std::string::npos);
  EXPECT_NE(request("/pair?uniqueid=challenge&phrase=pairchallenge"sv).find("status_code=\"200\""), std::string::npos);
  EXPECT_NE(request("/pair?uniqueid=missing"sv).find("Invalid uniqueid"), std::string::npos);

  std::string pairing_id;
  ASSERT_EQ(insert_pair_session(pending_session("out-of-order", "Client", "192.0.2.10"), pairing_id), pair_session_insert_e::ADDED);
  EXPECT_NE(request("/pair?uniqueid=out-of-order&clientchallenge=00"sv).find("Out of order"), std::string::npos);
}

/**
 * @brief HTTP dispatch reaches every pairing phase and rejects an unknown phase.
 */
TEST_F(PairingHttpHandlerTest, DispatchesEachPhaseAndRejectsUnknownRequests) {
  for (const auto phase : {"clientchallenge", "serverchallengeresp", "clientpairingsecret", "unknown"}) {
    std::string pairing_id;
    ASSERT_EQ(insert_pair_session(pending_session(phase, "Client", "192.0.2.10"), pairing_id), pair_session_insert_e::ADDED);
    const auto response = request(std::format("/pair?uniqueid={}&{}=00", phase, phase));
    EXPECT_NE(response.find("status_code=\"400\""), std::string::npos);
    const auto expected = std::string_view {phase} == "unknown" ? "Invalid pairing request" : "Out of order";
    EXPECT_NE(response.find(expected), std::string::npos) << phase;
    EXPECT_TRUE(get_pending_pairings().empty());
  }
}

TEST_F(PairingHttpHandlerTest, WebApprovalRequestRemainsPendingUntilCancelled) {
  std::packaged_task<std::string()> request_task {[this]() {
    return request(server_certificate_target("pending"));
  }};
  auto response = request_task.get_future();
  std::jthread request_thread {std::move(request_task)};

  const auto pairing_id = wait_for_pending_pairing();
  ASSERT_FALSE(pairing_id.empty());
  EXPECT_TRUE(cancel_pairing(pairing_id));
  EXPECT_NE(response.get().find("cancelled by operator"), std::string::npos);
}

TEST_F(PairingHttpHandlerTest, PinReturnsCompletedHandshakeResult) {
  for (const bool expected_result : {false, true}) {
    const auto unique_id = expected_result ? "successful-result"sv : "failed-result"sv;
    std::packaged_task<std::string()> request_task {[this, unique_id]() {
      return request(server_certificate_target(unique_id));
    }};
    auto client_response = request_task.get_future();
    std::jthread request_thread {std::move(request_task)};

    const auto pairing_id = wait_for_pending_pairing();
    ASSERT_FALSE(pairing_id.empty());
    config::stream.ping_timeout = std::chrono::seconds {2};
    std::packaged_task<bool()> pin_task {[&pairing_id]() {
      return pin(pairing_id, "5338", "Test client");
    }};
    auto pin_result = pin_task.get_future();
    std::jthread pin_thread {std::move(pin_task)};

    EXPECT_NE(client_response.get().find("status_code=\"200\""), std::string::npos);
    EXPECT_TRUE(nvhttp::test_support::complete_pairing(pairing_id, expected_result));
    EXPECT_EQ(pin_result.get(), expected_result);
  }
}

TEST_F(PairingHttpHandlerTest, PinReturnsFalseWhenClientDoesNotCompleteHandshake) {
  std::packaged_task<std::string()> request_task {[this]() {
    return request(server_certificate_target("wrong-pin"));
  }};
  auto client_response = request_task.get_future();
  std::jthread request_thread {std::move(request_task)};

  const auto pairing_id = wait_for_pending_pairing();
  ASSERT_FALSE(pairing_id.empty());
  config::stream.ping_timeout = std::chrono::milliseconds {50};
  EXPECT_FALSE(pin(pairing_id, "0000", "Test client"));
  EXPECT_NE(client_response.get().find("status_code=\"200\""), std::string::npos);
  EXPECT_TRUE(get_pending_pairings().empty());
}

TEST_F(PairingHttpHandlerTest, DuplicateAndCapacityErrorsReturnImmediately) {
  std::string pairing_id;
  ASSERT_EQ(insert_pair_session(pending_session("duplicate", "Original", "192.0.2.10"), pairing_id), pair_session_insert_e::ADDED);
  EXPECT_NE(request(server_certificate_target("duplicate")).find("status_code=\"409\""), std::string::npos);

  expire_pair_sessions(std::chrono::steady_clock::time_point::max());
  for (std::size_t index = 0; index < MAX_PENDING_PAIRING_SESSIONS; ++index) {
    ASSERT_EQ(
      insert_pair_session(pending_session(std::format("full-{}", index), "Client", "192.0.2.10"), pairing_id),
      pair_session_insert_e::ADDED
    );
  }
  EXPECT_NE(request(server_certificate_target("overflow")).find("status_code=\"503\""), std::string::npos);
}

TEST_F(PairingHttpHandlerTest, RetriedGetservercertReplacesAbandonedHandshake) {
  // First attempt: start pairing and approve the PIN, leaving the session mid-handshake.
  std::packaged_task<std::string()> first_request_task {[this]() {
    return request(server_certificate_target("retry"));
  }};
  auto first_response = first_request_task.get_future();
  std::jthread first_request_thread {std::move(first_request_task)};

  const auto first_pairing_id = wait_for_pending_pairing();
  ASSERT_FALSE(first_pairing_id.empty());
  config::stream.ping_timeout = std::chrono::seconds {10};
  std::packaged_task<bool()> pin_task {[&first_pairing_id]() {
    return pin(first_pairing_id, "5338", "Test client");
  }};
  auto pin_result = pin_task.get_future();
  std::jthread pin_thread {std::move(pin_task)};

  // PIN approval answers the held request and advances the session past the certificate
  // phase, so it no longer appears in the pending list.
  EXPECT_NE(first_response.get().find("status_code=\"200\""), std::string::npos);
  for (int attempt = 0; attempt < 100 && !get_pending_pairings().empty(); ++attempt) {
    std::this_thread::sleep_for(std::chrono::milliseconds {10});
  }
  EXPECT_TRUE(get_pending_pairings().empty());

  // A fresh getservercert for the same client replaces the abandoned handshake instead
  // of failing with 409 until the session expires.
  std::packaged_task<std::string()> retry_request_task {[this]() {
    return request(server_certificate_target("retry"));
  }};
  auto retry_response = retry_request_task.get_future();
  std::jthread retry_request_thread {std::move(retry_request_task)};

  const auto second_pairing_id = wait_for_pending_pairing();
  ASSERT_FALSE(second_pairing_id.empty());
  EXPECT_NE(second_pairing_id, first_pairing_id);
  EXPECT_FALSE(pin_result.get());  // The evicted handshake's waiter is woken with failure.
  EXPECT_TRUE(cancel_pairing(second_pairing_id));
  EXPECT_NE(retry_response.get().find("cancelled by operator"), std::string::npos);
}

TEST_F(PairingHttpHandlerTest, ConsolePinCompletesOrRejectsTheCertificatePhase) {
  setup(PRIVATE_KEY, PUBLIC_CERT);
  config::sunshine.flags[config::flag::PIN_STDIN] = true;

  std::istringstream input {"5338\n0000\n"};
  const cin_buffer_guard input_guard {input.rdbuf()};
  EXPECT_NE(request(server_certificate_target("console-success")).find("status_code=\"200\""), std::string::npos);
  EXPECT_NE(request(server_certificate_target("console-failure", "00")).find("status_code=\"400\""), std::string::npos);
}

TEST_F(PairingHttpHandlerTest, ConsolePinReportsSessionExpiration) {
  config::sunshine.flags[config::flag::PIN_STDIN] = true;
  gated_input_buffer input;
  const cin_buffer_guard input_guard {&input};
  std::packaged_task<std::string()> request_task {[this]() {
    return request(server_certificate_target("expired"));
  }};
  auto response = request_task.get_future();
  std::jthread request_thread {std::move(request_task)};

  ASSERT_FALSE(wait_for_pending_pairing().empty());
  expire_pair_sessions(std::chrono::steady_clock::time_point::max());
  input.release();
  EXPECT_NE(response.get().find("status_code=\"408\""), std::string::npos);
}

TEST_F(PairingSessionRegistryTest, PinApprovalTargetsExplicitPairingId) {
  std::string legitimate_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("legitimate", "Living Room", "192.0.2.10"), legitimate_pairing_id),
    pair_session_insert_e::ADDED
  );

  std::string attacker_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("attacker", "Living Room", "192.0.2.20"), attacker_pairing_id),
    pair_session_insert_e::ADDED
  );
  ASSERT_NE(legitimate_pairing_id, attacker_pairing_id);

  // Unit-test sessions have no parked HTTP response, so pin() returns false after
  // consuming the explicitly selected session. The competing request must remain untouched.
  EXPECT_FALSE(pin(legitimate_pairing_id, "1234", "Approved client"));

  const auto pending = get_pending_pairings();
  ASSERT_EQ(pending.size(), 1);
  EXPECT_EQ(pending.front().id, attacker_pairing_id);
  EXPECT_EQ(pending.front().address, "192.0.2.20");
}

TEST_F(PairingSessionRegistryTest, InvalidApprovalCannotConsumePendingSession) {
  std::string pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("legitimate", "Laptop", "192.0.2.10"), pairing_id),
    pair_session_insert_e::ADDED
  );

  EXPECT_FALSE(pin("unknown-approval", "1234", "Laptop"));
  EXPECT_FALSE(pin(pairing_id, "123", "Laptop"));
  EXPECT_FALSE(pin(pairing_id, "12a4", "Laptop"));
  EXPECT_FALSE(pin(pairing_id, "1234", ""));
  EXPECT_FALSE(pin(pairing_id, "1234", std::string(MAX_PAIRING_CLIENT_NAME_SIZE + 1, 'a')));

  const auto pending = get_pending_pairings();
  ASSERT_EQ(pending.size(), 1);
  EXPECT_EQ(pending.front().id, pairing_id);
}

TEST_F(PairingSessionRegistryTest, RestApiPairingFieldsAreValidatedServerSide) {
  EXPECT_TRUE(is_valid_pairing_id(std::string(PAIRING_ID_SIZE, 'a')));
  EXPECT_TRUE(is_valid_pairing_id("0123456789ABCDEF0123456789abcdef"));
  EXPECT_FALSE(is_valid_pairing_id(std::string(PAIRING_ID_SIZE - 1, 'a')));
  EXPECT_FALSE(is_valid_pairing_id(std::string(PAIRING_ID_SIZE, 'g')));

  EXPECT_TRUE(is_valid_pairing_pin("0000"));
  EXPECT_TRUE(is_valid_pairing_pin("9999"));
  EXPECT_FALSE(is_valid_pairing_pin("123"));
  EXPECT_FALSE(is_valid_pairing_pin("12a4"));

  EXPECT_TRUE(is_valid_pairing_name("Client"));
  EXPECT_TRUE(is_valid_pairing_name(std::string(MAX_PAIRING_CLIENT_NAME_SIZE, 'a')));
  EXPECT_FALSE(is_valid_pairing_name(""));
  EXPECT_FALSE(is_valid_pairing_name(std::string(MAX_PAIRING_CLIENT_NAME_SIZE + 1, 'a')));
}

TEST_F(PairingSessionRegistryTest, DuplicateUniqueIdIsRejectedWithoutReplacingOriginal) {
  std::string original_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("duplicate", "Original", "192.0.2.10"), original_pairing_id),
    pair_session_insert_e::ADDED
  );

  std::string rejected_pairing_id;
  EXPECT_EQ(
    insert_pair_session(pending_session("duplicate", "Replacement", "192.0.2.20"), rejected_pairing_id),
    pair_session_insert_e::ALREADY_EXISTS
  );
  EXPECT_TRUE(rejected_pairing_id.empty());

  const auto pending = get_pending_pairings();
  ASSERT_EQ(pending.size(), 1);
  EXPECT_EQ(pending.front().id, original_pairing_id);
  EXPECT_EQ(pending.front().name, "Original");
}

TEST_F(PairingSessionRegistryTest, PendingSessionStorageIsBounded) {
  for (std::size_t index = 0; index < MAX_PENDING_PAIRING_SESSIONS; ++index) {
    std::string pairing_id;
    ASSERT_EQ(
      insert_pair_session(pending_session(std::format("client-{}", index), "Client", "192.0.2.10"), pairing_id),
      pair_session_insert_e::ADDED
    );
    EXPECT_FALSE(pairing_id.empty());
  }

  std::string overflow_pairing_id;
  EXPECT_EQ(
    insert_pair_session(pending_session("overflow", "Overflow", "192.0.2.20"), overflow_pairing_id),
    pair_session_insert_e::FULL
  );
  EXPECT_EQ(get_pending_pairings().size(), MAX_PENDING_PAIRING_SESSIONS);
}

TEST_F(PairingSessionRegistryTest, ExpiredApprovalCannotConsumeLaterSession) {
  const auto expiration_check = std::chrono::steady_clock::now() + PAIRING_SESSION_TIMEOUT + std::chrono::seconds {1};
  std::string expired_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("expired", "Old client", "192.0.2.10"), expired_pairing_id),
    pair_session_insert_e::ADDED
  );
  expire_pair_sessions(expiration_check);
  EXPECT_TRUE(get_pending_pairings().empty());

  std::string current_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("current", "Current client", "192.0.2.20"), current_pairing_id),
    pair_session_insert_e::ADDED
  );
  EXPECT_FALSE(pin(expired_pairing_id, "1234", "Old client"));

  const auto pending = get_pending_pairings();
  ASSERT_EQ(pending.size(), 1);
  EXPECT_EQ(pending.front().id, current_pairing_id);
}

TEST_F(PairingSessionRegistryTest, CancellationRemovesOnlySelectedPendingSession) {
  std::string first_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("first", "First", "192.0.2.10"), first_pairing_id),
    pair_session_insert_e::ADDED
  );
  std::string second_pairing_id;
  ASSERT_EQ(
    insert_pair_session(pending_session("second", "Second", "192.0.2.20"), second_pairing_id),
    pair_session_insert_e::ADDED
  );

  EXPECT_TRUE(cancel_pairing(first_pairing_id));
  EXPECT_FALSE(cancel_pairing(first_pairing_id));

  const auto pending = get_pending_pairings();
  ASSERT_EQ(pending.size(), 1);
  EXPECT_EQ(pending.front().id, second_pairing_id);
}

TEST_F(PairingSessionRegistryTest, RemoveSessionErasesItsUniqueId) {
  auto session = pending_session("removable", "Client", "192.0.2.10");
  pair_session_t session_key;
  session_key.client.uniqueID = session.client.uniqueID;
  std::string pairing_id;
  ASSERT_EQ(insert_pair_session(std::move(session), pairing_id), pair_session_insert_e::ADDED);

  remove_session(session_key);
  EXPECT_TRUE(get_pending_pairings().empty());
}

TEST_F(PairingSessionRegistryTest, ConcurrentInsertionAndCancellationLeaveConsistentState) {
  constexpr std::size_t session_count = 16;
  std::atomic<std::size_t> successful_cancellations {0};
  std::vector<std::jthread> workers;
  workers.reserve(session_count);

  for (std::size_t index = 0; index < session_count; ++index) {
    workers.emplace_back([index, &successful_cancellations]() {
      std::string pairing_id;
      if (insert_pair_session(pending_session(std::format("concurrent-{}", index), "Client", "192.0.2.10"), pairing_id) == pair_session_insert_e::ADDED && cancel_pairing(pairing_id)) {
        ++successful_cancellations;
      }
    });
  }
  workers.clear();

  EXPECT_EQ(successful_cancellations, session_count);
  EXPECT_TRUE(get_pending_pairings().empty());
}